|
1
|
1 /***************************************************************************
|
|
|
2 * Copyright (C) 2005 by 510 Software Group *
|
|
|
3 * *
|
|
|
4 * *
|
|
|
5 * This program is free software; you can redistribute it and/or modify *
|
|
|
6 * it under the terms of the GNU General Public License as published by *
|
|
|
7 * the Free Software Foundation; either version 2 of the License, or *
|
|
|
8 * (at your option) any later version. *
|
|
|
9 * *
|
|
|
10 * This program is distributed in the hope that it will be useful, *
|
|
|
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
|
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
|
|
|
13 * GNU General Public License for more details. *
|
|
|
14 * *
|
|
|
15 * You should have received a copy of the GNU General Public License *
|
|
|
16 * along with this program; if not, write to the *
|
|
|
17 * Free Software Foundation, Inc., *
|
|
|
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
|
|
|
19 ***************************************************************************/
|
|
|
20
|
|
|
21 #ifndef syslogconfig_include
|
|
|
22 #define syslogconfig_include
|
|
|
23
|
|
|
24 #include "tokenizer.h"
|
|
|
25 #include <map>
|
|
3
|
26 #include <regex.h>
|
|
1
|
27
|
|
|
28
|
|
|
29 class SYSLOGCONFIG;
|
|
3
|
30 class CONFIG;
|
|
|
31
|
|
|
32 struct IPPAIR {
|
|
|
33 int first;
|
|
|
34 int last;
|
|
|
35 int cidr;
|
|
|
36 };
|
|
|
37
|
|
|
38 class PATTERN {
|
|
|
39 char * pattern; // owned by the string table
|
|
|
40 regex_t re;
|
|
|
41 int index; // zero based substring of the regex match that contains the ip address or hostname
|
|
|
42 int bucket; // count to add to the ip address leaky bucket
|
|
|
43 public:
|
|
|
44 ~PATTERN();
|
|
|
45 PATTERN(TOKEN &tok, char *pattern_, int index_, int bucket_);
|
|
|
46 bool process(char *buf, CONFIG &con);
|
|
|
47 void dump(int level);
|
|
|
48 };
|
|
1
|
49
|
|
|
50 typedef SYSLOGCONFIG * SYSLOGCONFIGP;
|
|
3
|
51 typedef PATTERN * PATTERNP;
|
|
1
|
52 typedef list<SYSLOGCONFIGP> syslogconfig_list;
|
|
3
|
53 typedef list<IPPAIR> ippair_list;
|
|
|
54 typedef list<PATTERNP> pattern_list;
|
|
2
|
55 const int buflen = 1024;
|
|
1
|
56
|
|
|
57 class SYSLOGCONFIG {
|
|
|
58 char * file_name; // name of the syslog file
|
|
3
|
59 pattern_list patterns; // owns the patterns
|
|
2
|
60 int fd;
|
|
|
61 int len; // bytes in the buffer
|
|
|
62 char buf[buflen];
|
|
1
|
63 public:
|
|
3
|
64 SYSLOGCONFIG(TOKEN &tok, char *file_name_);
|
|
1
|
65 ~SYSLOGCONFIG();
|
|
3
|
66 void add_pattern(PATTERNP pat);
|
|
|
67 bool failed() { return (fd == -1); };
|
|
|
68 bool read(CONFIG &con);
|
|
|
69 void process(CONFIG &con);
|
|
1
|
70 void dump(int level);
|
|
|
71 };
|
|
|
72
|
|
3
|
73 class CONFIG {
|
|
|
74 public:
|
|
1
|
75 // the only mutable stuff once it has been loaded from the config file
|
|
|
76 int reference_count; // protected by the global config_mutex
|
|
|
77 // all the rest is constant after loading from the config file
|
|
|
78 int generation;
|
|
|
79 time_t load_time;
|
|
|
80 string_set config_files;
|
|
3
|
81 int threshold;
|
|
|
82 ippair_list ignore; // owns all the ippairs
|
|
|
83 syslogconfig_list syslogconfigs; // owns all the syslogconfigs
|
|
1
|
84
|
|
|
85 CONFIG();
|
|
|
86 ~CONFIG();
|
|
3
|
87 void set_threshold(int threshold_) { threshold = threshold_; };
|
|
|
88 int get_threshold() { return threshold; };
|
|
2
|
89 void add_syslogconfig(SYSLOGCONFIGP con);
|
|
3
|
90 void add_pair(IPPAIR pair);
|
|
2
|
91 void dump();
|
|
|
92 void read();
|
|
3
|
93 void sleep(int duration);
|
|
|
94 bool looking(int ip);
|
|
1
|
95 };
|
|
|
96
|
|
|
97 void discard(string_set &s);
|
|
|
98 char* register_string(string_set &s, char *name);
|
|
|
99 char* register_string(char *name);
|
|
3
|
100 int ip_address(char *have);
|
|
1
|
101 bool load_conf(CONFIG &dc, char *fn);
|
|
|
102 void token_init();
|
|
|
103
|
|
3
|
104 extern char *token_bucket;
|
|
1
|
105 extern char *token_file;
|
|
3
|
106 extern char *token_ignore;
|
|
1
|
107 extern char *token_include;
|
|
3
|
108 extern char *token_index;
|
|
1
|
109 extern char *token_lbrace;
|
|
3
|
110 extern char *token_pattern;
|
|
1
|
111 extern char *token_rbrace;
|
|
|
112 extern char *token_semi;
|
|
3
|
113 extern char *token_slash;
|
|
|
114 extern char *token_threshold;
|
|
1
|
115
|
|
|
116 #endif
|
